Packagist/mahocommerce/maho CVE-2025-58449: high 8.7, EPSS 0.31%
Maho is Vulnerable to Authenticated Remote Code Execution via File Upload
Action: Upgrade mahocommerce/maho to 25.9.0 or later.
composer require mahocommerce/maho:25.9.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 25.9.0 | - |
Fixed versions
| 25.9.0 |
Sources
- osv: GHSA-vgmm-27fc-vmgp
- nvd: CVE-2025-58449
- https://github.com/MahoCommerce/maho/security/advisories/GHSA-vgmm-27fc-vmgp
- https://github.com/MahoCommerce/maho/commit/db54a1b44e9b3fd26b27ca4d5ece0af99c4dcb53
- https://github.com/MahoCommerce/maho
CVE-2025-58449 · published · modified · JSON